Quality control programs and certificates

In March, Harjit's office looks like a library that has been hit by a storm. Ironbridge's ASME certificates come up for renewal in the summer, and before the review team arrives, every section of the quality control manual has to be checked against what the shop actually does. He asks Kiera to help with the internal audit. "Most people think the certificate is the stamp," he says. "It isn't. The certificate is a promise that we'll do things the way our manual says, every time, on every job. The stamp is just the mark that shows we kept the promise." This lesson covers the certificates that let an organization build and repair pressure equipment, what a quality control system must contain, the role of the inspector inside the shop, how certificates are reviewed and renewed, and how internal audits and nonconformance reports keep the system honest.

Certificates of authorization

Nobody can build a boiler or pressure vessel to the ASME code, and mark it as such, without a certificate of authorization from ASME. Each certificate carries a designator for the kind of work it covers: S for power boilers, U for Section VIII, Division 1 pressure vessels, U2 for Division 2, H for heating boilers, PP for pressure piping, A for the assembly of power boilers and others for special work. A certificate also states its scope, such as shop only, field only or shop and field, and it lists the address of the shop it applies to. Ironbridge holds U and S certificates for its Nisku and Port Allen shops and for field work.

Repairs and alterations need their own authority: the National Board R certificate. Owner-users can hold their own authorities for work on their own equipment. Each certificate is valid for a fixed term, usually three years, and is renewed only after a review.

What a quality control system must contain

Every certificate rests on a written quality control system. Section VIII, Division 1 sets out what it must contain in a mandatory appendix, and Section I and the repair rules have similar lists. The system is described in a manual, and the manual is accepted by the review team before the certificate is issued. The required elements are the same in principle for every kind of certificate.

A manual is not meant to be a book on a shelf. Each element turns into a form, a log or a sign-off that people on the floor use: the receiving log from lesson 6, the traveler, the weld map, the welder continuity log from lesson 5, the calibration stickers on gauges, the heat treatment charts, the NDE reports and the nonconformance reports. When the inspector wants to know whether the shop follows its manual, he does not read the manual; he picks a job and asks to see the paper.

The inspector in the shop

For ASME work, the organization must have an agreement with an authorized inspection agency, whose inspector has access to the shop and the work at all times. Ironbridge's agreement is with its insurer's inspection division, and Grant Mahler is the authorized inspector assigned to it. The inspector reviews the design, checks materials, witnesses or reviews the hold points in the shop's inspection program, reviews welding and NDE records, witnesses the pressure test and signs the data report.

The inspector does not run the shop's quality system and is not the shop's quality control department. The shop does its own inspection first; the inspector verifies. A shop that waits for the inspector to find its mistakes has misunderstood the arrangement, and its inspector will soon spend more time there, which the shop pays for.

The review and renewal

Before a certificate is issued, and every time it is renewed, a review team visits the shop. For ASME certificates this is a joint review, with a representative of the authorized inspection agency and of the jurisdiction or the National Board, and sometimes an ASME team leader. For the R certificate, the National Board or the jurisdiction reviews the system. The team reads the manual, then watches the shop demonstrate it, often on a demonstration item: a small vessel or part built for the review, taken through design, material control, welding, examination and testing, with every record completed.

The team also interviews people. It may ask a welder to show where his WPS is and what it allows, ask a fitter how heat numbers are transferred, ask the receiving inspector what happens to material without a report, or ask anyone what they would do if they found a defect. Kiera is told she may be asked, and that the right answer to a question she cannot answer is "I'd check the manual and ask quality control", never a guess.

# Certificates and audit findings: what needs action before the review? (illustrative)
from datetime import date
today = date(2029, 3, 5)
certs = [("National Board R certificate", date(2029, 11, 30)), ("ASME U certificate (shop)", date(2029, 8, 14)), ("ASME S certificate (shop and field)", date(2030, 2, 3))]
for name, expires in certs:
    days = (expires - today).days
    print(f"{name:44} expires {expires.isoformat()}  ({days} days)" + ("  -> start renewal" if days < 183 else ""))
findings = [("IA-01", "calibration sticker missing on two pressure gauges", True), ("IA-02", "WPS 12 not listed in the procedure index", False), ("IA-03", "welder continuity log not signed for February", False), ("IA-04", "nonconformance NCR-88 closed without QC signature", True), ("IA-05", "manual revision page not issued to field crew", False)]
open_ = [f for f in findings if not f[2]]
print(f"{len(findings)} internal audit findings, {len(open_)} still open:")
for ref, text, closed in open_:
    print(f"  {ref}: {text}")

National Board R certificate                 expires 2029-11-30  (270 days)
ASME U certificate (shop)                    expires 2029-08-14  (162 days)  -> start renewal
ASME S certificate (shop and field)          expires 2030-02-03  (335 days)
5 internal audit findings, 3 still open:
  IA-02: WPS 12 not listed in the procedure index
  IA-03: welder continuity log not signed for February
  IA-05: manual revision page not issued to field crew

Internal audits and nonconformances

A good quality system checks itself. Ironbridge's manual calls for an internal audit of every element each year, by someone who does not do the work being audited. Kiera is paired with the shop's NDE coordinator to audit welding control. They pick three recent jobs, pull the weld maps, check that every weld has a welder, a WPS and a filler metal record, check that every welder was qualified and current on the date of the weld, and check that every WPS was supported by its PQR. They find that WPS 12 is missing from the procedure index, though the procedure itself is current, and that the welder continuity log for February was not signed. Both are recorded as findings.

A finding is closed only when the cause has been fixed, not just the symptom. The missing index entry is easy: the index is updated and checked. The unsigned log is more interesting. When Harjit asks why it was missed, the answer is that the foreman who usually signs it was on holiday and no one else knew to do it. The corrective action is to name a backup in the manual and to add the log to the foreman's handover list.

Nonconformance reports work the same way for products. When a part or a weld does not meet requirements, it is tagged, the problem is written up, and someone with the authority to decide dispositions it: use as is with the designer's agreement, repair, rework or reject. The inspector reviews dispositions that affect code compliance. Closing a nonconformance report without the required signature, as the audit found on NCR-88, is itself a finding.

Calibration and records

Two elements of the quality system cause more findings than any others in Harjit's experience: calibration and records. Every pressure gauge used for a test, every temperature indicator used for preheat, every welding machine meter that sets a procedure's current and every thickness gauge used for acceptance must be calibrated against a traceable standard at the interval the manual sets, labeled with its calibration date and due date, and withdrawn when it is overdue or damaged. The audit that found two gauges without stickers was finding exactly the kind of problem that could make a test record worthless: if a gauge cannot be shown to read correctly, nobody can say what pressure the vessel was tested at.

Records are the other half. The manual says which records are kept, by whom and for how long: data reports and their supporting records for at least the time the code requires, and often for the life of the item at the owner's request. Records must be legible, identifiable to the item and protected from loss. Ironbridge keeps paper originals for signed documents and scans everything into its job files, so that a question from an inspector about a vessel built ten years ago can be answered in minutes.

A gauge used for a hydrostatic test should have a range of roughly one and a half to four times the test pressure, so that the test reading falls in the most accurate part of the dial. Harjit keeps a gauge board in the test bay with calibrated gauges in several ranges, and a test is not started until the gauge on it has been checked against the board's log.

The manual also says who has the authority to stop work. At Ironbridge that is the quality control manager and anyone he names, and the manual is clear that a stop for quality reasons cannot be overruled by production. Harjit has used that authority only a handful of times, but every time the review team visits, it asks to see the paragraph and asks a foreman whether he knows it is there.